FIDO authentication method and device based on living body face recognition authentication and electronic equipment

Abstract

The invention provides an FIDO authentication method and device based on living body face recognition authentication and electronic equipment, and relates to the technical field of online identity authentication. The method comprises the following steps: transmitting an online fast identity authentication FIDO service request based on living body face recognition authentication to an application server; receiving the FIDO service strategy message transmitted by the application server, calling an FIDO development kit SDK according to the FIDO service strategy message to call a third-party living body face recognition authentication SDK to obtain living body capture information, and generating an FIDO service response message meeting the FIDO standard according to the living body capture information and the FIDO service strategy message; and transmitting the living body capture information and the FIDO service response message to an application server. According to the method, a third-party living body face recognition authentication service can be called to realize living body face recognition and use an FIDO authentication function.

Description

Technical Field

[0001] The present invention relates to the technical field of online identity authentication, and in particular to a FIDO authentication method, device, and electronic device based on live face recognition authentication. Background Art

[0002] The Fast Identity Online (FIDO) standard has become a mature biometric authentication method in the market. The FIDO standard is a universal international standard that defines the protocol flow and specifications between FIDO clients, FIDO authenticators, and FIDO servers. It enables fast authentication for client applications and a convenient user experience through biometric authentication methods such as fingerprint and 3D facial recognition.

[0003] However, the authentication methods involved in the existing FIDO standard authentication rely on biometric authentication locally supported by the terminal device, such as fingerprint and 3D face authentication in mobile terminals. Currently, there are not many terminal models with 3D face authentication, resulting in a large number of terminal models being unable to use the FIDO face authentication function. Summary of the Invention

[0004] The present invention provides a FIDO authentication method based on live face recognition authentication, which is used to solve the defect in the prior art that a large number of terminal models cannot use the FIDO face authentication function. By embedding the live face recognition function of calling a third-party live face recognition authentication service in the FIDO authentication process, the FIDO standard authentication method is added, and the live face recognition and FIDO authentication function of calling a third-party live face recognition authentication service are realized, which makes up for the low support rate of FIDO face recognition models.

[0005] The present invention provides a FIDO authentication method based on live face recognition authentication, which is applied to an application client and includes the following steps: Transmitting a FIDO service request for online rapid identity authentication based on live face recognition to an application server, so that the application server calls the FIDO server to generate a FIDO service policy message; receiving the FIDO service policy message transmitted by the application server, invoking a third-party live face recognition authentication SDK by invoking a FIDO development kit SDK according to the FIDO service policy message to obtain liveness capture information, and generating a FIDO service response message that complies with the FIDO standard based on the liveness capture information and the FIDO service policy message; The liveness capture information and the FIDO service response message are transmitted to the application server, so that the application server calls the FIDO server to call the third-party liveness face recognition authentication server for liveness comparison authentication according to the liveness capture information, and calls the FIDO server to perform FIDO signature verification according to the FIDO service response message to complete the FIDO service request.

[0006] According to a FIDO authentication based on live face recognition authentication provided by the present invention, the method of obtaining liveness capture information by calling a third-party live face recognition authentication SDK by calling the FIDO SDK according to the FIDO service policy message, and generating a FIDO service response message that complies with the FIDO standard according to the liveness capture information and the FIDO service policy message includes: Call the third-party live face recognition authentication SDK through the FIDO SDK to perform liveness detection and authentication to obtain the liveness capture information: Performing a hash calculation on the living body capture information to obtain a first hash value; Generate a FIDO initial service message according to the FIDO specification standard, write the first hash value into the extension field of the FIDO initial service message to obtain a processed service message, digitally sign the processed service message, and obtain the FIDO service response message.

[0007] According to a FIDO authentication based on live face recognition authentication provided by the present invention, the FIDO service request includes a FIDO open request and a FIDO authentication request, the FIDO service response message includes a FIDO open response message and a FIDO authentication response message, and the digital signing of the processed service message to obtain the FIDO service response message includes: If the FIDO service request is the FIDO Open request, digitally sign the processed service message using the FIDO device metadata private key to obtain the FIDO Open response message; If the FIDO service request is the FIDO authentication request, the processed service message is digitally signed using the user private key to obtain the FIDO authentication response message.

[0008] The present invention also provides a FIDO authentication method based on live face recognition authentication, which is applied to an application server and includes the following steps: In response to a FIDO service request based on liveness facial recognition authentication transmitted by an application client, calling a FIDO server to generate a FIDO service policy message, and returning the FIDO service policy message to the application client, so that the application client can obtain liveness capture information by calling a third-party liveness facial recognition authentication SDK through a FIDO development kit SDK according to the FIDO service policy message, and generate a FIDO service response message that complies with the FIDO standard based on the liveness capture information and the FIDO service policy message; Receive the liveness capture information and the FIDO service response message transmitted by the application client, call the FIDO server to call the third-party liveness face recognition authentication server to perform liveness comparison authentication according to the liveness capture information, and call the FIDO server to perform FIDO signature verification according to the FIDO service response message to complete the FIDO service request.

[0009] According to a FIDO authentication based on live face recognition authentication provided by the present invention, the FIDO service response message is obtained by signing a FIDO initial service message including a first hash value, wherein the first hash value is obtained by hashing the liveness capture information; the FIDO service request is completed by calling a FIDO server to call a third-party live face recognition authentication server for liveness comparison authentication based on the liveness capture information, and the FIDO service request is completed by calling the FIDO server to perform FIDO signature verification based on the FIDO service response message, including: Calling a third-party live face recognition authentication server through the FIDO server to perform liveness comparison authentication on the liveness captured information to obtain a liveness comparison authentication result; When the liveness comparison authentication result indicates that the liveness comparison authentication is successful, performing a hash calculation on the liveness capture information to obtain a second hash value; Performing signature verification on the FIDO service response message, and obtaining the first hash value if the signature verification passes; Compare the first hash value and the second hash value, and complete the FIDO service request according to a result of the comparison.

[0010] According to a FIDO authentication based on live face recognition authentication provided by the present invention, the FIDO service response message also includes a user public key, the FIDO service request is a FIDO open request, and the signature verification of the FIDO service response message is performed. If the signature verification passes, obtaining the first hash value includes: Performing signature verification on the FIDO service response message using the FIDO metadata public key, and obtaining the first hash value and the user public key if the signature verification passes; The comparing the first hash value and the second hash value, and completing the FIDO service request according to a result of the comparison, includes: Comparing the first hash value and the second hash value, if the first hash value and the second hash value are consistent, storing the user public key and completing the FIDO open request.

[0011] According to a FIDO authentication based on live face recognition authentication provided by the present invention, the FIDO service request is a FIDO authentication request, and the signature verification is performed on the FIDO service response message. If the signature verification passes, obtaining the first hash value includes: Performing signature verification on the FIDO service response message using the user public key, and obtaining the first hash value if the signature verification passes; The comparing the first hash value and the second hash value, and completing the FIDO service request according to a result of the comparison, includes: Compare the first hash value and the second hash value. If the first hash value and the second hash value are consistent, complete the FIDO authentication request.

[0012] The present invention also provides a FIDO authentication device based on live face recognition authentication, comprising the following modules: A request transmission module is used to transmit a FIDO service request for online rapid identity authentication based on live face recognition authentication to an application server, so that the application server calls the FIDO server to generate a FIDO service policy message; an information acquisition module, configured to receive the FIDO service policy message transmitted by the application server, obtain liveness capture information by calling a third-party liveness face recognition authentication SDK by calling a FIDO development kit SDK according to the FIDO service policy message, and generate a FIDO service response message that complies with the FIDO standard based on the liveness capture information and the FIDO service policy message; A message transmission module is configured to transmit the liveness capture information and the FIDO service response message to the application server, so that the application server can call the FIDO server to call the third-party liveness face recognition authentication server for liveness comparison authentication based on the liveness capture information, and call the FIDO server to perform FIDO signature verification based on the FIDO service response message to complete the FIDO service request.

[0013] The present invention also provides a FIDO authentication device based on live face recognition authentication, comprising the following modules: a message acquisition module, configured to, in response to a FIDO service request based on live face recognition authentication transmitted by an application client, invoke a FIDO server to generate a FIDO service policy message, and return the FIDO service policy message to the application client, so that the application client can obtain liveness capture information by invoking a third-party live face recognition authentication SDK through a FIDO development kit (SDK) according to the FIDO service policy message, and generate a FIDO service response message that complies with the FIDO standard based on the liveness capture information and the FIDO service policy message; An authentication and verification module is configured to receive the liveness capture information and the FIDO service response message transmitted by the application client, call a FIDO server to call a third-party liveness face recognition authentication server to perform liveness comparison authentication based on the liveness capture information, and call a FIDO server to perform FIDO signature verification based on the FIDO service response message to complete the FIDO service request.

[0014] The present invention also provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and running on the processor. When the processor executes the computer program, it implements the FIDO authentication method based on live face recognition authentication as described in any one of the above.

[0015] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the FIDO authentication method based on live face recognition authentication as described in any one of the above is implemented.

[0016] The present invention also provides a computer program product, including a computer program, which, when executed by a processor, implements any of the above-described FIDO authentication methods based on live face recognition authentication.

[0017] The FIDO authentication method, device, and electronic device based on live face recognition authentication provided by the present invention add a FIDO standard authentication method by embedding a live face recognition function that calls a third-party live face recognition authentication service in the FIDO authentication process, and realizes the use of FIDO authentication function for live face recognition by calling a third-party live face recognition authentication service, thus making up for the low support rate of FIDO face recognition models. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] In order to more clearly illustrate the technical solutions in the present invention or the prior art, a brief introduction is given below to the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0019] Figure 1 This is one of the flow charts of the FIDO authentication method based on live face recognition authentication provided by the present invention.

[0020] Figure 2 This is the second flow chart of the FIDO authentication method based on live face recognition authentication provided by the present invention.

[0021] Figure 3 It is a schematic diagram of the relationship between the application client and the application server provided by the present invention.

[0022] Figure 4 This is a schematic diagram of the overall process of opening a FIDO authentication process based on live face recognition authentication provided by the present invention.

[0023] Figure 5 This is a schematic diagram of the overall flow of the signature verification process of FIDO authentication based on live face recognition authentication provided by the present invention.

[0024] Figure 6 This is a structural diagram of the FIDO authentication device based on live face recognition authentication provided by the present invention.

[0025] Figure 7 This is a structural diagram of the FIDO authentication device based on live face recognition authentication provided by the present invention.

[0026] Figure 8 It is a schematic diagram of the physical structure of the electronic device provided by the present invention. DETAILED DESCRIPTION

[0027] To make the objectives, technical solutions, and advantages of the present invention more clear, the technical solutions of the present invention will be clearly and completely described below in conjunction with the accompanying drawings. Obviously, the embodiments described are only some of the embodiments of the present invention, not all of them. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts shall fall within the scope of protection of the present invention.

[0028] The Fast Identity Online (FIDO) standard has become a mature biometric authentication method in the market. The FIDO standard is a universal international standard that defines the protocol flow and specifications between FIDO clients, FIDO authenticators, and FIDO servers. It enables fast authentication for client applications and a convenient user experience through biometric authentication methods such as fingerprint and 3D facial recognition.

[0029] However, the authentication methods involved in the existing FIDO standard authentication rely on biometric authentication locally supported by the terminal device, such as fingerprint and 3D face authentication in mobile terminals. Currently, there are not many terminal models with 3D face authentication, resulting in a large number of terminal models being unable to use the FIDO face authentication function.

[0030] In view of this, an embodiment of the present invention provides a FIDO authentication method based on live face recognition authentication. The method comprises transmitting a FIDO service request for online rapid identity authentication based on live face recognition authentication to an application server; receiving the FIDO service policy message transmitted by the application server; invoking a third-party live face recognition authentication SDK by invoking a FIDO development kit (SDK) based on the FIDO service policy message to obtain liveness capture information; generating a FIDO service response message that complies with the FIDO standard based on the liveness capture information and the FIDO service policy message; transmitting the liveness capture information and the FIDO service response message to the application server, so that the application server invokes a third-party live face recognition authentication server based on the liveness capture information by invoking a FIDO server to perform liveness comparison authentication; and invoking the FIDO server based on the FIDO service response message to perform FIDO signature verification to complete the FIDO service request. This method can implement FIDO authentication using live face recognition by invoking a third-party live face recognition authentication service, thus addressing the current low support rate of FIDO face recognition models.

[0031] The technical solutions in the embodiments of the present invention will be described below with reference to the accompanying drawings in the embodiments of the present invention.

[0032] Figure 1 This is one of the flow charts of the FIDO authentication method based on live face recognition authentication provided by the present invention. The FIDO authentication method based on live face recognition authentication can be applied to electronic devices, which can be various types of devices with information processing capabilities during implementation. For example, the electronic device can include a personal computer, a laptop, a PDA or a server, etc.; the electronic device can also be a mobile terminal, for example, the mobile terminal can include a mobile phone, a car computer, a tablet computer or a projector, etc. Figure 1As shown, when applied to an application client, the method may include the following steps 101 to 103: Step 101: Transmitting a FIDO service request for online rapid identity authentication based on live face recognition authentication to an application server, so that the application server calls the FIDO server to generate a FIDO service policy message.

[0033] It should be noted that the application APP client and the application server can establish an SSL secure transmission channel to ensure the security and encryption of the transmission channel. When the application client receives a FIDO service request based on live face recognition authentication, it can initiate a FIDO service request to the application server. The FIDO service request can be a face recognition activation / registration request, or a face recognition verification request, etc. When the application server receives the FIDO service request, it can call the FIDO server to activate FIDO live biometrics, so that the FIDO server generates a FIDO service policy message. The FIDO service policy message can be generated in accordance with the FIDO specification standard or in other ways. The present invention does not limit the way in which the application server calls the FIDO server to generate the FIDO service policy message.

[0034] Exemplarily, the FIDO server generates a random number and generates a FIDO service policy message, such as a FIDO authentication policy message reqMessage, and returns it to the FIDO client under the application client.

[0035] Step 102: Receive the FIDO service policy message transmitted by the application server, call the FIDO SDK to call the third-party live face recognition authentication SDK to obtain liveness capture information according to the FIDO service policy message, and generate a FIDO service response message that complies with the FIDO standard based on the liveness capture information and the FIDO service policy message.

[0036] It should be noted that after the application client receives the FIDO service policy message, it sends it to the FIDO client development toolkit SDK. When the FIDO SDK determines that it is a liveness authentication based on the FIDO service policy message, it calls the third-party liveness face recognition authentication SDK. After the liveness detection authentication such as blinking and shaking the head is passed, the front-end detection completes the callback and returns the liveness capture information liveInfo, which contains the best face bestFace and other necessary information fields.

[0037] Additionally, the FIDO client SDK can generate user keys (SK, PK) using a default method. This default method requires calling the system's setUserAuthenticationRequired(False) interface to enable key usage. The FIDO client SDK assembles the initial service message according to the FIDO specification. For example, it generates an open response message based on a random number and can sign it using a preset private key to obtain a FIDO service policy message.

[0038] Step 103: Transmit the liveness capture information and the FIDO service response message to the application server, so that the application server calls the FIDO server to call the third-party liveness face recognition authentication server for liveness comparison authentication based on the liveness capture information, and calls the FIDO server to perform FIDO signature verification based on the FIDO service response message to complete the FIDO service request.

[0039] It should be noted that after generating the FIDO service response message regResp, the FIDO service response message and the liveness capture information regResp+liveInfo are sent to the application server for authentication.

[0040] It can be understood that the present invention introduces a third-party live face recognition function, embeds the live face recognition function that calls the third-party live face recognition authentication service into the FIDO authentication process, adds the FIDO standard authentication method, and realizes the use of the FIDO authentication function for live face recognition (such as blinking, shaking head, etc.), thereby making up for the current low support rate of FIDO face recognition models.

[0041] In some embodiments, when applying FIDO face authentication technology, since 3D faces are not currently widely used in customer-initialized identity verification scenarios, they are not effective in authenticating the customer's true intentions, which will limit the application of FIDO technology in identity authentication scenarios.

[0042] In an embodiment of the present invention, the obtaining of liveness capture information by calling a third-party liveness face recognition and authentication SDK through the FIDO SDK according to the FIDO service policy message, and generating a FIDO service response message that complies with the FIDO standard according to the liveness capture information and the FIDO service policy message may include: calling a third-party liveness face recognition and authentication SDK through the FIDO SDK to perform liveness detection and authentication to obtain the liveness capture information; performing a hash calculation on the liveness capture information to obtain a first hash value; generating a FIDO initial service message according to the FIDO specification standard, writing the first hash value into an extension field of the FIDO initial service message to obtain a processed service message, and digitally signing the processed service message to obtain the FIDO service response message.

[0043] It should be noted that the FIDO client SDK can calculate the hash value H1 = Hash(LiveInfo). The FIDO client SDK then assembles the Open Response message according to the FIDO specification, fills H1 into its extension field, signs it with the preset private key, generates the FIDO service response message regResp, and sends regResp + liveInfo to the server for authentication.

[0044] It is understandable that the current live face recognition (such as blinking, shaking head, etc.) of FIDO clients is implemented by introducing a third-party service engine. It is widely used in customer-initialized identity verification scenarios and is effective in authenticating the user's authenticity and intention.

[0045] In some embodiments, live face recognition is a non-device local biometric authentication, which requires the live face authentication client to interact with the background authentication, and is implemented through image / video analysis algorithms. The authentication principle does not introduce a cryptographic mechanism to ensure the integrity verification of the authentication.

[0046] In an embodiment of the present invention, the FIDO service request includes a FIDO open request and a FIDO authentication request, the FIDO service response message includes a FIDO open response message and a FIDO authentication response message, and the digitally signing the processed service message to obtain the FIDO service response message may include: if the FIDO service request is the FIDO open request, using the FIDO device metadata private key to digitally sign the processed service message to obtain the FIDO open response message; if the FIDO service request is the FIDO authentication request, using the user private key to digitally sign the processed service message to obtain the FIDO authentication response message.

[0047] It should be noted that the FIDO service request includes a FIDO Open request and a FIDO Authentication request. If the FIDO service request is the FIDO Open request, the FIDO device metadata private key is used to sign the request, generating a FIDO Open response message regResp, and sending regResp + liveInfo to the server for authentication. If the FIDO service request is the FIDO Authentication request, the client private key SK is used to sign the request, generating a FIDO Authentication response message authResp, and sending authResp + liveInfo to the server for authentication.

[0048] As can be understood, this invention expands the application scenarios of FIDO biometric authentication and improves the compliant use of FIDO technology in initial identity verification scenarios such as customer registration and account opening, thereby enhancing the user experience. By effectively combining FIDO with live face recognition and using FIDO cryptographic mechanisms to ensure the integrity and non-repudiation of the authentication process, this invention adds a layer of security protection to live face recognition authentication.

[0049] Figure 2 This is the second flow chart of the FIDO authentication method based on live face recognition authentication provided by the present invention. The FIDO authentication method based on live face recognition authentication can be applied to electronic devices, which can be various types of devices with information processing capabilities during implementation. For example, the electronic device can include a personal computer, a laptop, a PDA or a server, etc.; the electronic device can also be a mobile terminal, for example, the mobile terminal can include a mobile phone, a car computer, a tablet computer or a projector, etc. Figure 2 As shown, when applied to an application server, the method may include the following steps 201 to 202: Step 201: In response to a FIDO service request based on live face recognition authentication transmitted by an application client, the FIDO server is called to generate a FIDO service policy message, and the FIDO service policy message is returned to the application client, so that the application client can obtain liveness capture information by calling a third-party live face recognition authentication SDK by calling the FIDO SDK according to the FIDO service policy message, and generate a FIDO service response message that complies with the FIDO standard according to the liveness capture information and the FIDO service policy message.

[0050] It should be noted that calling the FIDO server to generate a FIDO service policy message and returning the FIDO service policy message to the application client may involve the application service calling the FIDO server to authenticate FIDO live biometrics, the FIDO server generating a random number, generating a FIDO authentication policy message authMessage, and returning it to the FIDO client. Alternatively, the application service calling the FIDO server to enable FIDO live biometrics, the FIDO server generating a random number, generating a FIDO authentication policy message reqMessage, and returning it to the FIDO client.

[0051] Step 202: Receive the liveness capture information and the FIDO service response message transmitted by the application client, call the FIDO server to call the third-party liveness face recognition authentication server to perform liveness comparison authentication based on the liveness capture information, and call the FIDO server to perform FIDO signature verification based on the FIDO service response message to complete the FIDO service request.

[0052] It should be noted that calling the FIDO server to call a third-party live face recognition authentication server for liveness comparison authentication according to the liveness capture information may be a method of image matching, etc., and calling the FIDO server to perform FIDO signature verification according to the FIDO service response message may be a method of signature verification according to the FIDO protocol standard. The present invention does not limit calling the FIDO server to call a third-party live face recognition authentication server for liveness comparison authentication according to the liveness capture information, and calling the FIDO server to perform FIDO signature verification according to the FIDO service response message.

[0053] It can be understood that the FIDO authentication method based on live face recognition authentication provided by the present invention combines FIDO technical specifications and third-party live face recognition authentication functions, introduces third-party live face recognition authentication to complete the FIDO standard authentication process, and adds a live face recognition authentication method to FIDO authentication, which makes up for the problem of low support rate of FIDO face recognition models.

[0054] In some embodiments, the FIDO service response message is obtained by signing a FIDO initial service message including a first hash value, where the first hash value is obtained by hashing the liveness capture information. The steps of calling a FIDO server to call a third-party liveness face recognition and authentication server to perform liveness comparison authentication based on the liveness capture information, and calling the FIDO server to perform FIDO signature verification based on the FIDO service response message to complete the FIDO service request may include: calling a third-party liveness face recognition and authentication server to perform liveness comparison authentication on the liveness capture information through the FIDO server to obtain a liveness comparison authentication result; if the liveness comparison authentication result indicates that the liveness comparison authentication is successful, hashing the liveness capture information to obtain a second hash value; performing signature verification on the FIDO service response message to obtain the first hash value if the signature verification passes; comparing the first hash value with the second hash value, and completing the FIDO service request based on the comparison result.

[0055] It's important to note that after receiving the regResp+liveInfo message, the application service can implement liveness authentication through a third-party liveness server. If liveness authentication succeeds, the hash value H2 = Hash(liveInfo) is calculated, and the subsequent FIDO authentication process is completed. This involves verifying the validity of the regResp signature. Upon successful signature verification, H1 and H2 are compared for consistency. If they match, the FIDO service request is completed.

[0056] It can be understood that the present invention increases the application scenarios of FIDO biometric authentication and improves the compliant use of FIDO technology in initial identity verification scenarios such as customer registration and account opening, thereby enhancing the user experience.

[0057] In some embodiments, the FIDO service response message also includes a user public key, the FIDO service request is a FIDO open request, and the signature verification of the FIDO service response message, and obtaining the first hash value when the signature verification passes, may include: using the FIDO metadata public key to perform signature verification on the FIDO service response message, and obtaining the first hash value and the user public key when the signature verification passes; comparing the first hash value and the second hash value, and completing the FIDO service request according to the result of the comparison, includes: comparing the first hash value and the second hash value, and if the first hash value and the second hash value are consistent, storing the user public key to complete the FIDO open request.

[0058] For example, after receiving the regResp+liveInfo message, the application service will implement liveness authentication through a third-party liveness server. If liveness authentication is successful, the hash value H2 = Hash(liveInfo) is calculated, and the FIDO subsequent authentication process continues. The FIDO metadata public key is used to verify the validity of the regResp signature. After successful signature verification, H1 and H2 are compared for consistency. If they are consistent, the user public key PK is stored, completing the activation process. At this point, the activation process completes the association between FIDO authentication and liveness facial recognition, enabling liveness facial recognition to use FIDO authentication.

[0059] Furthermore, the FIDO service request is a FIDO authentication request, and the performing signature verification on the FIDO service response message, and obtaining the first hash value if the signature verification passes, may include: performing signature verification on the FIDO service response message using the user public key, and obtaining the first hash value if the signature verification passes; and comparing the first hash value and the second hash value, and completing the FIDO service request according to the result of the comparison, including: comparing the first hash value and the second hash value, and if the first hash value and the second hash value are consistent, completing the FIDO authentication request.

[0060] For example, after receiving the authResp+liveInfo message, the application service can implement liveness authentication through a third-party liveness face recognition server. If liveness authentication is successful, the hash value H2 = Hash(liveInfo) is calculated, and the FIDO subsequent authentication process is completed. The user's public key PK is used to verify the validity of the authResp signature. After the signature verification is successful, H1 and H2 are compared for consistency. If they are consistent, the authentication process is completed and a success result is returned.

[0061] It's understandable that by effectively combining FIDO with live face recognition, the integrity and non-repudiation of the authentication process are guaranteed through the FIDO cryptographic mechanism. This adds a layer of security to live face recognition authentication. While ensuring security, it also expands FIDO application scenarios and enhances the user experience.

[0062] It can be understood that the present invention improves the compliant use of FIDO technology in initial identity verification scenarios such as customer registration and account opening, and increases the application scenarios of FIDO biometric authentication.

[0063] The following describes exemplary applications of the embodiments of the present invention in two practical application scenarios.

[0064] Figure 3 This is a schematic diagram of the relationship between the application client and the application server provided by the present invention. Figure 3As shown in the figure, the FIDO authentication solution based on live facial recognition authentication consists of three parts: the relying party service, the FIDO service, and the third-party live facial recognition authentication service. In this solution, the relying party is generally the actual application, such as an app and its corresponding application service. The relying party client calls the FIDO client SDK, which in turn calls the third-party live facial recognition authentication SDK. The relying party server application then connects to the FIDO server and the third-party live facial recognition authentication server. The solution adds FIDO standard authentication methods, enabling live facial recognition authentication (such as blinking and shaking the head) using FIDO authentication functions, expanding the application scenarios of FIDO biometric authentication and improving the user experience.

[0065] Figure 4 This is a schematic diagram of the overall process of the FIDO authentication start-up process based on live face recognition authentication provided by the present invention. Figure 4 As shown, the method includes the following steps: (1) Application APP and application services need to establish an SSL secure transmission channel to ensure the security and encryption of the transmission channel.

[0066] (2) The application APP initiates a registration request, and the application service calls the FIDO server to enable FIDO live biometric recognition.

[0067] (3) The FIDO server generates a random number and a FIDO authentication policy message, reqMessage, and returns it to the FIDO client.

[0068] (4) When the FIDO client SDK determines that it is a live authentication, it calls the third-party live face recognition authentication SDK. After the live detection authentication such as blinking and shaking the head is passed, the front-end detection completes the callback and returns the live capture information liveInfo, which contains the best face bestFace and other necessary information fields. The FIDO client SDK calculates the hash value H1=Hash(LiveInfo).

[0069] (5) The FIDO client SDK generates user keys (SK, PK) by default. The default method here requires calling the system setUserAuthenticationRequired(False) interface to implement the use of the key.

[0070] (6) The FIDO client SDK assembles the open response message according to the FIDO specification standard, fills H1 into its extension field, signs it with the FIDO device metadata private key, generates the FIDO open response message regResp, and sends regResp+liveInfo to the server for authentication.

[0071] (7) After receiving the regResp+liveInfo message, the application service will implement the liveness authentication function through the third-party liveness server. If the liveness authentication is successful, the hash value H2=Hash(liveInfo) is calculated and the FIDO subsequent authentication process is completed.

[0072] (8) Use the FIDO metadata public key to verify the validity of the regResp signature. After the signature verification is successful, compare the consistency of H1 and H2. If they are consistent, store the user public key PK and complete the activation process. At this point, the association between FIDO authentication and live face recognition is completed during the activation process, and the live face recognition function using FIDO authentication is realized.

[0073] Figure 5 This is a schematic diagram of the overall flow of the signature verification process of FIDO authentication based on live face recognition authentication provided by the present invention. Figure 5 As shown, the method includes the following steps: (1) Application APP and application services need to establish an SSL secure transmission channel to ensure the security and encryption of the transmission channel.

[0074] (2) The application APP initiates an authentication request, and the application service calls the FIDO server to authenticate FIDO live biometrics.

[0075] (3) The FIDO server generates a random number and generates a FIDO authentication policy message authMessage, which is returned to the FIDO client.

[0076] (4) When the FIDO client SDK determines that it is a live authentication, it calls the third-party live face recognition authentication SDK. After the live detection authentication such as blinking and shaking the head is passed, the front-end detection completes the callback and returns the live capture information liveInfo, which contains the best face bestFace and other necessary information fields. The FIDO client SDK calculates the hash value H1=Hash(LiveInfo).

[0077] (5) The FIDO client SDK assembles the authentication response message according to the FIDO specification standard, fills H1 into its extension field, signs it with the client private key SK, generates the FIDO authentication response message authResp, and sends authResp+liveInfo to the server for authentication.

[0078] (6) After receiving the authResp+liveInfo message, the application service will implement the liveness authentication function through the third-party liveness face recognition server. If the liveness authentication is successful, the hash value H2 = Hash(liveInfo) is calculated, and the FIDO subsequent authentication process is continued. The user's public key PK is used to verify the validity of the authResp signature. After the signature verification is successful, the consistency of H1 and H2 is compared. If they are consistent, the authentication process is completed and a successful result is returned.

[0079] The method provided by this invention for applying FIDO authentication based on live face recognition enables mobile live face recognition and FIDO authentication, as well as an effective combination of the two. This method, by introducing third-party live face recognition capabilities, enables live face recognition (e.g., blinking, shaking the head, etc.) to be used with FIDO authentication. This addresses the current low support rate for FIDO face recognition devices. While ensuring security, it also improves the compliant use of FIDO technology in initial identity verification scenarios such as customer registration and account opening, expanding the application scenarios of FIDO biometric authentication and enhancing the user experience. Furthermore, it adds a layer of security protection to live face recognition, enhancing the security of the solution.

[0080] It is understood that the terminal biometric authentication component of the FIDO authentication method based on live facial recognition can be a fast identity authentication standard based on the FIDO protocol. Its technical principles and characteristics include terminal local biometric authentication, terminal local signature, and server-side signature verification. Similar biometric authentication technical principles include the IIFAA protocol and the Soter protocol standards. In addition, the IIFAA and Soter technical standards can also implement biometric authentication-related functions in the FIDO authentication method based on live facial recognition.

[0081] Based on the aforementioned embodiments, an embodiment of the present invention provides a FIDO authentication device based on live face recognition authentication. The modules included in the device, and the units included in each module, can be implemented by a processor; of course, they can also be implemented by specific logic circuits. During implementation, the processor can be a central processing unit (CPU), a microprocessor (MPU), a digital signal processor (DSP), or a field programmable gate array (FPGA), etc.

[0082] The following describes the FIDO authentication device based on live face recognition authentication provided by the present invention. The FIDO authentication device based on live face recognition authentication described below and the FIDO authentication method based on live face recognition authentication described above can be referenced to each other.

[0083] Figure 6 This is a schematic diagram of the structure of the FIDO authentication device based on live face recognition authentication provided by the present invention. Figure 6 As shown, the apparatus 300 includes a request transmission module 301, an information acquisition module 302, and a message transmission module 303, wherein: A request transmission module 301 is used to transmit a FIDO service request for online rapid identity authentication based on live face recognition authentication to an application server, so that the application server calls the FIDO server to generate a FIDO service policy message; An information acquisition module 302 is configured to receive the FIDO service policy message transmitted by the application server, obtain liveness capture information by invoking a third-party liveness face recognition authentication SDK by invoking a FIDO development kit SDK according to the FIDO service policy message, and generate a FIDO service response message that complies with the FIDO standard based on the liveness capture information and the FIDO service policy message; The message transmission module 303 is configured to transmit the liveness capture information and the FIDO service response message to the application server, so that the application server can call the FIDO server to call the third-party liveness face recognition authentication server for liveness comparison authentication based on the liveness capture information, and call the FIDO server to perform FIDO signature verification based on the FIDO service response message to complete the FIDO service request.

[0084] In some embodiments, the information acquisition module 302 includes an information capture unit, a hash calculation unit, and a response acquisition unit, wherein: The capture information unit is used to call a third-party live face recognition authentication SDK through the FIDO SDK to perform liveness detection and authentication to obtain the liveness capture information: The hash calculation unit is configured to perform a hash calculation on the living body capture information to obtain a first hash value; The response acquisition unit is configured to generate a FIDO initial service message according to the FIDO specification standard, write the first hash value into an extension field of the FIDO initial service message to obtain a processed service message, digitally sign the processed service message, and obtain the FIDO service response message.

[0085] In some embodiments, the FIDO service request includes a FIDO open request and a FIDO authentication request, the FIDO service response message includes a FIDO open response message and a FIDO authentication response message, and the response acquisition unit is specifically used to: if the FIDO service request is the FIDO open request, use the FIDO device metadata private key to digitally sign the processed service message to obtain the FIDO open response message; if the FIDO service request is the FIDO authentication request, use the user private key to digitally sign the processed service message to obtain the FIDO authentication response message.

[0086] In an embodiment of the present invention, a live face recognition function that calls a third-party live face recognition authentication service can be embedded in the FIDO authentication process, an authentication method of the FIDO standard is added, and the live face recognition function using the FIDO authentication function is realized by calling a third-party live face recognition authentication service.

[0087] Figure 7 This is a schematic diagram of the structure of the FIDO authentication device based on live face recognition authentication provided by the present invention. Figure 7 As shown, the apparatus 400 includes a message acquisition module 401 and an authentication verification module 402, wherein: A message acquisition module 401 is configured to, in response to a FIDO service request based on liveness facial recognition authentication transmitted by an application client, invoke a FIDO server to generate a FIDO service policy message, and return the FIDO service policy message to the application client, so that the application client can obtain liveness capture information by invoking a third-party liveness facial recognition authentication SDK through a FIDO development kit (SDK) according to the FIDO service policy message, and generate a FIDO service response message that complies with the FIDO standard based on the liveness capture information and the FIDO service policy message. The authentication and verification module 402 is configured to receive the liveness capture information and the FIDO service response message transmitted by the application client, call the FIDO server to call a third-party liveness face recognition authentication server to perform liveness comparison authentication based on the liveness capture information, and call the FIDO server to perform FIDO signature verification based on the FIDO service response message to complete the FIDO service request.

[0088] In some embodiments, the FIDO service response message is obtained by signing a FIDO initial service message including a first hash value, where the first hash value is obtained by hashing the liveness capture information, and the authentication verification module 402 includes a first comparison unit, a hash solution unit, a signature verification unit, and a second comparison unit, wherein: The first comparison unit is configured to call a third-party live face recognition authentication server through the FIDO server to perform liveness comparison authentication on the liveness captured information to obtain a liveness comparison authentication result; The hash solving unit is configured to perform a hash calculation on the liveness capture information to obtain a second hash value when the liveness comparison authentication result indicates that the liveness comparison authentication is successful; The signature verification unit is configured to perform signature verification on the FIDO service response message, and obtain the first hash value if the signature verification passes; The second comparison unit is configured to compare the first hash value and the second hash value, and complete the FIDO service request according to a result of the comparison.

[0089] In some embodiments, the FIDO service response message also includes a user public key, and the signature verification unit is specifically used to: use the FIDO metadata public key to perform signature verification on the FIDO service response message, and when the signature verification passes, obtain the first hash value and the user public key; the second comparison unit is specifically used to: compare the first hash value and the second hash value, and if the first hash value and the second hash value are consistent, store the user public key and complete the FIDO opening request.

[0090] In some embodiments, the FIDO service request is a FIDO authentication request, and the signature verification unit is specifically used to: use the user public key to perform signature verification on the FIDO service response message, and if the signature verification passes, obtain the first hash value; the second comparison unit is specifically used to: compare the first hash value and the second hash value, and if the first hash value and the second hash value are consistent, complete the FIDO authentication request.

[0091] In an embodiment of the present invention, a live face recognition function that calls a third-party live face recognition authentication service can be embedded in the FIDO authentication process, an authentication method of the FIDO standard is added, and the live face recognition function using the FIDO authentication function is realized by calling a third-party live face recognition authentication service.

[0092] Figure 8 Schematic diagram of the physical structure of the electronic device provided by the present invention. Figure 8As shown, the electronic device 500 may include: a processor 510, a communication interface 520, a memory 530, and a communication bus 540, wherein the processor 510, the communication interface 520, and the memory 530 communicate with each other via the communication bus 540. The processor 510 may call the logic instructions in the memory 530 to execute the FIDO authentication method based on live face recognition authentication, the method comprising: transmitting a FIDO service request for online rapid identity authentication based on live face recognition authentication to an application server, so that the application server calls the FIDO server to generate a FIDO service policy message; receiving the FIDO service policy message transmitted by the application server, invoking a third-party live face recognition authentication SDK by invoking a FIDO development kit SDK according to the FIDO service policy message to obtain liveness capture information, and generating a FIDO service response message that complies with the FIDO standard based on the liveness capture information and the FIDO service policy message; Transmitting the liveness capture information and the FIDO service response message to the application server, so that the application server calls the FIDO server to call the third-party liveness face recognition authentication server to perform liveness comparison authentication according to the liveness capture information, and calls the FIDO server to perform FIDO signature verification according to the FIDO service response message to complete the FIDO service request; or In response to a FIDO service request based on liveness facial recognition authentication transmitted by an application client, calling a FIDO server to generate a FIDO service policy message, and returning the FIDO service policy message to the application client, so that the application client can obtain liveness capture information by calling a third-party liveness facial recognition authentication SDK through a FIDO development kit SDK according to the FIDO service policy message, and generate a FIDO service response message that complies with the FIDO standard based on the liveness capture information and the FIDO service policy message; Receive the liveness capture information and the FIDO service response message transmitted by the application client, call the FIDO server to call the third-party liveness face recognition authentication server to perform liveness comparison authentication according to the liveness capture information, and call the FIDO server to perform FIDO signature verification according to the FIDO service response message to complete the FIDO service request.

[0093] Furthermore, the logic instructions in the aforementioned memory 530 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the portion that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions for causing a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as a USB flash drive, a mobile hard drive, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk.

[0094] On the other hand, the present invention further provides a computer program product, comprising a computer program that can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the FIDO authentication method based on live face recognition authentication provided by the above methods, the method comprising: transmitting a FIDO service request for online rapid identity authentication based on live face recognition authentication to an application server, so that the application server calls a FIDO server to generate a FIDO service policy message; receiving the FIDO service policy message transmitted by the application server, invoking a third-party live face recognition authentication SDK by invoking a FIDO development kit SDK according to the FIDO service policy message to obtain liveness capture information, and generating a FIDO service response message that complies with the FIDO standard based on the liveness capture information and the FIDO service policy message; Transmitting the liveness capture information and the FIDO service response message to the application server, so that the application server calls the FIDO server to call the third-party liveness face recognition authentication server to perform liveness comparison authentication according to the liveness capture information, and calls the FIDO server to perform FIDO signature verification according to the FIDO service response message to complete the FIDO service request; or In response to a FIDO service request based on liveness facial recognition authentication transmitted by an application client, calling a FIDO server to generate a FIDO service policy message, and returning the FIDO service policy message to the application client, so that the application client can obtain liveness capture information by calling a third-party liveness facial recognition authentication SDK through a FIDO development kit SDK according to the FIDO service policy message, and generate a FIDO service response message that complies with the FIDO standard based on the liveness capture information and the FIDO service policy message; Receive the liveness capture information and the FIDO service response message transmitted by the application client, call the FIDO server to call the third-party liveness face recognition authentication server to perform liveness comparison authentication according to the liveness capture information, and call the FIDO server to perform FIDO signature verification according to the FIDO service response message to complete the FIDO service request.

[0095] The computer program product includes one or more computer instructions. When loaded and executed on a computer, the computer program instructions fully or partially perform the processes or functions described in accordance with the embodiments of the present invention. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions may be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions may be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via a wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) method. The computer-readable storage medium may be any available medium capable of computer storage or a data storage device such as a server or data center that integrates one or more available media. The available medium may be magnetic media (e.g., floppy disks, hard disks, magnetic tapes), optical media (e.g., DVDs), or semiconductor media (e.g., solid-state drives (SSDs)).

[0096] In another aspect, the present invention further provides a non-transitory computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the computer program is implemented to perform the FIDO authentication method based on live face recognition authentication provided by the above methods, the method comprising: transmitting a FIDO service request for online rapid identity authentication based on live face recognition authentication to an application server, so that the application server calls a FIDO server to generate a FIDO service policy message; receiving the FIDO service policy message transmitted by the application server, invoking a third-party live face recognition authentication SDK by invoking a FIDO development kit SDK according to the FIDO service policy message to obtain liveness capture information, and generating a FIDO service response message that complies with the FIDO standard based on the liveness capture information and the FIDO service policy message; Transmitting the liveness capture information and the FIDO service response message to the application server, so that the application server calls the FIDO server to call the third-party liveness face recognition authentication server to perform liveness comparison authentication based on the liveness capture information, and calls the FIDO server to perform FIDO signature verification based on the FIDO service response message to complete the FIDO service request; or In response to a FIDO service request based on liveness facial recognition authentication transmitted by an application client, calling a FIDO server to generate a FIDO service policy message, and returning the FIDO service policy message to the application client, so that the application client can obtain liveness capture information by calling a third-party liveness facial recognition authentication SDK through a FIDO development kit SDK according to the FIDO service policy message, and generate a FIDO service response message that complies with the FIDO standard based on the liveness capture information and the FIDO service policy message; Receive the liveness capture information and the FIDO service response message transmitted by the application client, call the FIDO server to call the third-party liveness face recognition authentication server to perform liveness comparison authentication according to the liveness capture information, and call the FIDO server to perform FIDO signature verification according to the FIDO service response message to complete the FIDO service request.

[0097] The computer-readable storage medium may be any combination of one or more computer-readable media. The computer-readable medium may be a computer-readable signal medium or a computer-readable storage medium. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples (a non-exhaustive list) of computer-readable storage media include: an electrical connection having one or more conductors, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM) or flash memory, optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In this document, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device.

[0098] A computer-readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, which carries computer-readable program code. Such a propagated data signal may take a variety of forms, including, but not limited to, electromagnetic signals, optical signals, or any suitable combination thereof. A computer-readable signal medium may also be any computer-readable medium other than a computer-readable storage medium that can transmit, propagate, or transport a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0099] Program code embodied on a computer-readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wireline, optical fiber cable, radio frequency (RF), etc., or any suitable combination of the foregoing.

[0100] Computer program code for performing the operations of this specification may be written in one or more programming languages, or a combination thereof, including object-oriented programming languages such as Java, Smalltalk, and C++, as well as conventional procedural programming languages such as "C" or similar programming languages. The program code may execute entirely on the user's computer, partially on the user's computer, as a stand-alone software package, partially on the user's computer and partially on a remote computer, or entirely on the remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., through the Internet using an Internet service provider).

[0101] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, i.e., they may be located in one location or distributed across multiple network units. Some or all of the modules may be selected based on actual needs to achieve the objectives of the present embodiment. Persons of ordinary skill in the art will be able to understand and implement the present invention without inventive effort.

[0102] Through the above description of the embodiments, those skilled in the art will clearly understand that each embodiment can be implemented using software plus a necessary general-purpose hardware platform, or of course, hardware. Based on this understanding, the essence of the above technical solution, or the portion that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a magnetic disk, or an optical disk, and includes a number of instructions for causing a computer device (such as a personal computer, server, or network device) to execute the methods described in each embodiment or certain portions of the embodiments.

[0103] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the various embodiments of the present invention.

Claims

1. A FIDO authentication method based on live face recognition authentication, characterized in that: Applied to application clients, including: Transmitting a FIDO service request for online rapid identity authentication based on live face recognition authentication to an application server, so that the application server calls the FIDO server to generate a FIDO service policy message; receiving the FIDO service policy message transmitted by the application server, invoking a third-party live face recognition authentication SDK by invoking a FIDO development kit SDK according to the FIDO service policy message to obtain liveness capture information, and generating a FIDO service response message that complies with the FIDO standard based on the liveness capture information and the FIDO service policy message; The liveness capture information and the FIDO service response message are transmitted to the application server, so that the application server calls the FIDO server to call the third-party liveness face recognition authentication server for liveness comparison authentication according to the liveness capture information, and calls the FIDO server to perform FIDO signature verification according to the FIDO service response message to complete the FIDO service request.

2. The FIDO authentication method based on live face recognition authentication according to claim 1, characterized in that: The method further includes: calling the FIDO SDK to call a third-party live face recognition authentication SDK to obtain liveness capture information according to the FIDO service policy message, and generating a FIDO service response message that complies with the FIDO standard according to the liveness capture information and the FIDO service policy message, including: Call the third-party live face recognition authentication SDK through the FIDO SDK to perform liveness detection and authentication to obtain the liveness capture information: Performing a hash calculation on the living body capture information to obtain a first hash value; Generate a FIDO initial service message according to the FIDO specification standard, write the first hash value into the extension field of the FIDO initial service message to obtain a processed service message, digitally sign the processed service message, and obtain the FIDO service response message.

3. The FIDO authentication method based on live face recognition authentication according to claim 2, characterized in that: The FIDO service request includes a FIDO open request and a FIDO authentication request, the FIDO service response message includes a FIDO open response message and a FIDO authentication response message, and the digitally signing the processed service message to obtain the FIDO service response message includes: If the FIDO service request is the FIDO Open request, digitally sign the processed service message using the FIDO device metadata private key to obtain the FIDO Open response message; If the FIDO service request is the FIDO authentication request, the processed service message is digitally signed using the user private key to obtain the FIDO authentication response message.

4. A FIDO authentication method based on live face recognition authentication, characterized in that: Applied to the application server, including: In response to a FIDO service request based on liveness facial recognition authentication transmitted by an application client, calling a FIDO server to generate a FIDO service policy message, and returning the FIDO service policy message to the application client, so that the application client can obtain liveness capture information by calling a third-party liveness facial recognition authentication SDK through a FIDO development kit SDK according to the FIDO service policy message, and generate a FIDO service response message that complies with the FIDO standard based on the liveness capture information and the FIDO service policy message; Receive the liveness capture information and the FIDO service response message transmitted by the application client, call the FIDO server to call the third-party liveness face recognition authentication server to perform liveness comparison authentication according to the liveness capture information, and call the FIDO server to perform FIDO signature verification according to the FIDO service response message to complete the FIDO service request.

5. The FIDO authentication method based on live face recognition authentication according to claim 4, characterized in that: The FIDO service response message is obtained by signing a FIDO initial service message including a first hash value, where the first hash value is obtained by hashing the liveness capture information. The method of calling a FIDO server to call a third-party liveness face recognition authentication server to perform liveness comparison authentication based on the liveness capture information, and calling the FIDO server to perform FIDO signature verification based on the FIDO service response message to complete the FIDO service request includes: Calling a third-party live face recognition authentication server through the FIDO server to perform liveness comparison authentication on the liveness captured information to obtain a liveness comparison authentication result; When the liveness comparison authentication result indicates that the liveness comparison authentication is successful, performing a hash calculation on the liveness capture information to obtain a second hash value; Performing signature verification on the FIDO service response message, and obtaining the first hash value if the signature verification passes; Compare the first hash value and the second hash value, and complete the FIDO service request according to a result of the comparison.

6. The FIDO authentication method based on live face recognition authentication according to claim 5, characterized in that: The FIDO service response message also includes a user public key, the FIDO service request is a FIDO open request, and performing signature verification on the FIDO service response message, and obtaining the first hash value when the signature verification passes, includes: Performing signature verification on the FIDO service response message using the FIDO metadata public key, and obtaining the first hash value and the user public key if the signature verification passes; The comparing the first hash value and the second hash value, and completing the FIDO service request according to a result of the comparison, includes: Comparing the first hash value and the second hash value, if the first hash value and the second hash value are consistent, storing the user public key and completing the FIDO open request.

7. The FIDO authentication method based on live face recognition authentication according to claim 6, characterized in that: The FIDO service request is a FIDO authentication request, and the performing signature verification on the FIDO service response message, and obtaining the first hash value if the signature verification passes, includes: Performing signature verification on the FIDO service response message using the user public key, and obtaining the first hash value if the signature verification passes; The comparing the first hash value and the second hash value, and completing the FIDO service request according to a result of the comparison, includes: Compare the first hash value and the second hash value. If the first hash value and the second hash value are consistent, complete the FIDO authentication request.

8. A FIDO authentication device based on live face recognition authentication, characterized in that: Applied to application clients, including: A request transmission module is used to transmit a FIDO service request for online rapid identity authentication based on live face recognition authentication to an application server, so that the application server calls the FIDO server to generate a FIDO service policy message; an information acquisition module, configured to receive the FIDO service policy message transmitted by the application server, obtain liveness capture information by calling a third-party liveness face recognition authentication SDK by calling a FIDO development kit SDK according to the FIDO service policy message, and generate a FIDO service response message that complies with the FIDO standard based on the liveness capture information and the FIDO service policy message; A message transmission module is configured to transmit the liveness capture information and the FIDO service response message to the application server, so that the application server can call the FIDO server to call the third-party liveness face recognition authentication server for liveness comparison authentication based on the liveness capture information, and call the FIDO server to perform FIDO signature verification based on the FIDO service response message to complete the FIDO service request.

9. A FIDO authentication device based on live face recognition authentication, characterized in that: Applied to the application server, including: a message acquisition module, configured to, in response to a FIDO service request based on live face recognition authentication transmitted by an application client, invoke a FIDO server to generate a FIDO service policy message, and return the FIDO service policy message to the application client, so that the application client can obtain liveness capture information by invoking a third-party live face recognition authentication SDK through a FIDO development kit (SDK) according to the FIDO service policy message, and generate a FIDO service response message that complies with the FIDO standard based on the liveness capture information and the FIDO service policy message; An authentication and verification module is configured to receive the liveness capture information and the FIDO service response message transmitted by the application client, call a FIDO server to call a third-party liveness face recognition authentication server to perform liveness comparison authentication based on the liveness capture information, and call a FIDO server to perform FIDO signature verification based on the FIDO service response message to complete the FIDO service request.

10. An electronic device comprising a memory, a processor, and a computer program stored in the memory and running on the processor, characterized in that: When the processor executes the computer program, the FIDO authentication based on live face recognition authentication is implemented as described in any one of claims 1 to 7.

Images